BigBear Phishing Bypasses Microsoft 365 MFA at 258 Organizations
CloudSEK found BigBear 2.0 stealing Microsoft 365 session cookies after MFA. Revoke sessions, rotate credentials and require phishing-resistant sign-in.
Read article →identity
Authentication, access, credentials, and identity systems.
Latest in identity
Attackers Exploit NetScaler Flaw to Bypass Authentication
Customer-managed VPN and AAA appliances need branch-specific fixed builds; configuration determines exposure on later NetScaler releases.
Read article →
Sliver Toolkit Scripts Credential Theft and Persistent Domain Access
A recovered Sliver kit shows how one operator scripted Domain Admin access, disabled defenses, stole credentials, and hid rotating command servers behind Ethereum.
Read article →
JSCeal Replays Browser Sessions to Steal Fresh Google Tokens
Recovered JSCeal code replays stolen cookies and passwords through a headless browser to obtain fresh Google OAuth tokens and exposes concrete Windows hunt artifacts.
Read article →
LiteLLM Flaw Lets Read-Only Accounts Steal AI Gateway Secrets
Zenity saw file-read probes matching CVE-2026-35029. LiteLLM advises upgrading to 1.83.0 or later; defenders should hunt configuration changes and rotate exposed secrets.
Read article →
Attackers Breach JetBrains Cloud Coding Service and Expose Credentials
JetBrains confirmed that an unpatched TeamCity flaw exposed Cadence users’ code and secrets. Former users should rotate credentials and review connected systems.
Read article →
Chinese-Speaking Operator Uses AI Agents in Government and Education Intrusions
Five exposed SecFlow workspaces linked Claude, Qwen and DeepSeek to Asian government and education intrusions involving credential theft, webshells, and implants.
Read article →
Fake Microsoft Teams Support Calls Plant Persistent Node.js Backdoors
Microsoft observed fake IT support sessions progress from Teams remote control to a persistent JavaScript implant and WinRM movement toward domain controllers.
Read article →
Ransomware Server Exposes Credential Theft and EDR-Killer Toolkit
A server tied to The Gentlemen exposed TukTuk C2, a credential-stealing prompt, EDR-killer research, exfiltrated Jira data, and healthcare credentials.
Read article →
Attackers Used METR’s Exposed API Key for Credits Worth $600,000
A fail-open agent dashboard exposed one public-model key for three weeks, while noisy usage signals and absent spend limits delayed recognition.
Read article →
Malicious Chrome and Edge Extensions Steal Wallet Secrets and Passwords
Socket found 19 browser extensions using automatic updates, rotating command servers and injected modules to steal wallet secrets, sessions and passwords.
Read article →
BREEZE COMET Hijacks Brazilian Payment Systems for Fraud
Mandiant traced BREEZE COMET from vishing, rogue branch hardware and stolen cloud credentials to payment APIs used for hundreds of fraudulent transfers.
Read article →
Exposed Server Reveals Aurora Operator's Breach Playbook Across 17 Organizations
An exposed server revealed a repeatable Active Directory attack path, AI-assisted planning, Aurora lockers, and payment trails across multiple victims.
Read article →Showing 1–13 of 32